CVE-2026-72140 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should be aware of this vulnerability and take necessary actions to prevent potential use-after-free vulnerabilities. Affected product deployments should be reviewed for exposure, and owners should be assigned for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability has a high impact on Linux kernel's i2c: mlxbf module and requires immediate attention from Linux kernel maintainers and users to prevent potential use-after-free vulnerabilities. Security teams and vulnerability management teams should also be aware of this vulnerability and take necessary actions to prevent potential use-after-free vulnerabilities. Asset inventory and rollback/change windows should be reviewed to ensure that affected systems are properly managed. Source tracking should also be implemented to monitor and track the vulnerability. Overall, this vulnerability requires a high level of attention from various stakeholders to prevent potential use-after-free vulnerabilities. The CVE record indicates a use-after-free vulnerability in the Linux kernel's i2c: mlxbf module, and it is essential to review and apply the provided patch to prevent potential use-after-free vulnerabilities. Linux kernel maintainers and users should prioritize reviewing and applying the provided patch to prevent potential use-after-free vulnerabilities. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring and detection should be implemented to identify potential security threats. Asset inventory and rollback/change windows should be reviewed to ensure that affected systems are properly managed. Source tracking should be implemented to monitor and track the vulnerability. Security teams and vulnerability management teams should be aware of this vulnerability and take necessary actions to prevent potential use-after-free vulnerabilities. A

Technical summary

The CVE record describes a use-after-free vulnerability in the Linux kernel's i2c: mlxbf module. The issue arises when devm_platform_get_and_ioremap_resource() returns an error, leading to a potential use-after-free in mlxbf_i2c_init_resource(). This vulnerability affects Linux kernel maintainers, users, and administrators. The error code should be saved before freeing tmp_res to prevent use-after-free.

Defensive priority

Linux kernel maintainers and users should prioritize reviewing and applying the provided patch to prevent potential use-after-free vulnerabilities.

Recommended defensive actions

• Review and apply the provided patch to prevent potential use-after-free vulnerabilities
• Monitor Linux kernel updates for further information on this vulnerability
• Perform inventory checks to identify affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates a use-after-free vulnerability in the Linux kernel's i2c: mlxbf module. The issue arises when devm_platform_get_and_ioremap_resource() returns an error, leading to a potential use-after-free in mlxbf_i2c_init_resource().

Official resources